This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. An attacker without authentication can exploit this flaw over HTTP to read a subset of data accessible through Helidon. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and limited confidentiality impact without integrity or availability effects. The affected versions are 4.0.0 through 4.4.1 inclusive, and 4.5.0. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability but does not explicitly confirm patch availability for these versions in the provided data.

Successful exploitation results in unauthorized read access to a subset of data accessible via Helidon, potentially exposing sensitive information. There is no impact on data integrity or availability. The vulnerability can be exploited remotely without authentication, increasing risk if the affected service is exposed to untrusted networks.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. However, the provided advisory does not explicitly confirm the availability of a patch for this specific vulnerability in the affected Helidon versions. Users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Until a patch is applied, restricting network access to Helidon services and monitoring for unusual access attempts may reduce exposure.